Security Policy

1Reporting a vulnerability

Email [email protected]. Tell us what you found, where, and how to reproduce it. A proof of concept helps; a video is fine; a scanner report on its own usually is not.

Acknowledgement

We aim to acknowledge reports promptly.

First assessment

We assess reports by impact and follow up with the reporter.

Fix target

We prioritise confirmed findings by impact and keep the reporter informed. A target is not a guarantee of a specific resolution date.

Disclosure

We work with reporters on reasonable coordinated disclosure, taking account of affected users and any ongoing investigation.

Credit

We name you in the changelog if you want to be named, and stay quiet if you do not.

We do not run a paid bug bounty. We are a small company and would rather say that plainly than imply a reward we will not pay.

2Safe harbour for good-faith research

If you follow the rules below, we will not pursue legal action against you, and we will say so in writing to anyone who asks. We treat your research as authorised for the purposes of computer-misuse law and of our own Terms.

• Test only against your own account and your own data. Do not access, modify or retain anyone else's.
• Stop as soon as you have confirmed a vulnerability. Do not pivot deeper to see how far it goes.
• If you access personal data by accident, stop, tell us immediately, and delete it. Do not keep a copy as proof.
• No denial of service, no volumetric or stress testing, no spam, no social engineering of our people or our providers, and no physical attacks.
• Do not use a finding to extract data, place trades, or gain paid entitlements you have not bought.
• Give us reasonable time to fix it before you publish.

Break those and the safe harbour does not apply. In particular, an extortion demand attached to a report is not research, and we will treat it as what it is.

3How the Service is protected

We use access controls, protected connections, backups and monitoring to operate the service. Security measures are reviewed as the service changes. Detailed configurations and internal response procedures are kept private. No service can promise complete security.

We hold no ISO 27001 or SOC 2 certification, and we do not imply one. If your procurement process needs a security questionnaire completed, write to [email protected] and we will answer it honestly.

4If we suffer a breach

We maintain a written incident response procedure. In an incident involving personal data:

• We contain it first, then investigate scope, then notify. In that order.
• Where the breach is likely to risk your rights and freedoms, we notify the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) within 72 hours of becoming aware of it, as Article 33 GDPR requires.
• Where the risk to you is high, we tell you directly and without undue delay, in plain language: what happened, what data was involved, what we have done, and what you should do — Article 34 GDPR.
• Business customers with a data processing agreement are notified without undue delay so they can meet their own obligations.
• We provide affected users and authorities with the information required by law. We may publish a broader update when doing so is appropriate and does not compromise security or privacy.

We will not describe a breach as a "security incident affecting a limited number of accounts" when it is not, and we will not delay telling you in order to finish the investigation first.

5Your part

• Use a unique password, or sign in with Google.
• Treat API keys like passwords. Rotate one you have pasted anywhere public, immediately.
• Tell us at [email protected] the moment you suspect your account is compromised.
• Remember that we will never ask you for your password, and never ask you to move funds anywhere. Anyone who does is not us.

OmniOS OÜ never takes custody of crypto-assets and never asks for a private key or seed phrase, for any reason, ever.